The same hazard can produce radically different outcomes because risk is shaped by what is exposed, how sensitive it is and how well the system can adapt.
Two facilities can sit in the same flood zone and face very different levels of enterprise risk.
One may have elevated critical equipment, alternative logistics routes, tested continuity plans, strong insurance, diversified suppliers and the financial capacity to recover. The other may depend on one access road, vulnerable electrical infrastructure, just-in-time inventory and a supplier network exposed to the same event.
The hazard is similar. The vulnerability is not.
This distinction matters because climate discussions often begin with maps of floods, bushfires, heat, storms or sea-level exposure. Those maps are useful, but they are not the whole risk picture. Exposure tells leaders where contact with a hazard may occur. It does not tell them how severely the organisation will be affected or how quickly it can recover.
The Strategic Context
The supplied climate-change study notes, drawing on IPCC 2007 [SOURCE DETAILS REQUIRED] and Fellmann 2012, describe vulnerability through the interaction of exposure, sensitivity and adaptive capacity. They also distinguish between biophysical vulnerability and socioeconomic vulnerability.
Biophysical vulnerability concerns the physical conditions that influence harm: climate variability, hazards, topography, land use, water availability, infrastructure, habitat quality, thresholds, duration and magnitude.
Socioeconomic vulnerability concerns the capacity of people and institutions to cope and adapt: wealth, economic diversity, public health, education, information, technology, planning, governance, social cohesion, equity and related factors.
The important management insight is that climate risk is not produced by weather alone. It emerges from the interaction between an external hazard and the system that receives it.
For executives, this shifts attention from forecasting the hazard to designing the organisation.
What Leaders Commonly Misread
The first misreading is to equate hazard with risk.
A severe hazard does not automatically create severe enterprise impact if exposure is limited or the system is robust. Conversely, a moderate hazard can be highly damaging when the organisation is sensitive and lacks recovery capacity.
The second misreading is to focus only on physical assets. Climate vulnerability can enter through people, suppliers, utilities, transport, data infrastructure, communities, customers and public services. A site may remain intact while its workforce cannot reach it, its electricity is interrupted or its key supplier fails.
The third misreading is to treat resilience as a technical property. Engineering matters, but socioeconomic and organisational factors matter too. A technically strong asset can still be vulnerable if governance is slow, decision rights are unclear or the organisation lacks cash, information or trained people to respond.
The fourth misreading is to assume national or regional exposure translates evenly across organisations. The source material explicitly notes that climate impacts are not homogeneous. Conditions vary by place, sector and community, and so does capacity to adapt.
Reframing the Issue
A more useful executive model is:
Enterprise climate risk is shaped by hazard, exposure, sensitivity and adaptive capacity.
This is best treated as a diagnostic relationship rather than a precise formula.
- Hazard asks what event or long-term change may occur.
- Exposure asks which assets, people, suppliers, customers or ecosystems are in contact with it.
- Sensitivity asks how strongly those exposed elements respond.
- Adaptive capacity asks whether the system can anticipate, absorb, respond, recover and change.
The same model can be applied beyond climate. Cyber incidents, supply shocks, geopolitical disruption and infrastructure failure all show similar behaviour: consequence depends on the architecture of the system, not only the initiating event.
Strategic Analysis: Vulnerability as a Property of the System
Physical exposure is only the first layer
A manufacturing plant exposed to extreme heat may face reduced equipment efficiency, worker-safety constraints, cooling demand and grid stress. The direct hazard is temperature. The enterprise impact depends on equipment design, building performance, shift patterns, energy supply and operational flexibility.
A logistics business exposed to flooding may not lose warehouses, yet still suffer if road access, ports or subcontractors are disrupted.
A healthcare provider may face rising demand during extreme weather at the same time staff availability and infrastructure reliability decline.
The hazard enters through interfaces.
Sensitivity reveals where small changes create large consequences
Sensitivity is often hidden until thresholds are crossed.
An asset may perform normally across a broad range of conditions, then degrade sharply beyond a temperature, water-quality or load threshold. A supplier may cope with short disruptions but fail once inventory buffers are exhausted. A workforce may tolerate occasional heat events but not sustained exposure.
This is why averages can mislead. Strategic risk often sits in thresholds, duration and coincidence.
Leaders should ask where the system changes behaviour non-linearly. Those points deserve more attention than general statements about exposure.
Adaptive capacity is an enterprise capability
Adaptive capacity is sometimes reduced to emergency response. It is broader.
It includes the ability to obtain information, make decisions, mobilise capital, alter operating practices, redesign assets, diversify supply, build partnerships and learn from events.
A business with strong adaptive capacity can change before disruption becomes existential. A business with weak adaptive capacity may repeatedly recover to the same vulnerable state.
This creates an important distinction between recovery and adaptation. Recovery restores operations. Adaptation changes the conditions that made the organisation vulnerable.
Vulnerability can be concentrated outside the organisation
The socioeconomic dimension of the source material is especially important for enterprise risk. Organisations depend on communities and institutions that may have very different capacities to absorb disruption.
A business may have resilient facilities but operate in a region where emergency services, housing, transport, healthcare or utilities are under stress. That wider vulnerability can affect labour availability, customer demand, licence to operate and recovery time.
The organisation therefore needs to understand not only its own resilience, but the resilience of the systems it relies on.
Decision Framework
ERANORTH proposes a Climate Vulnerability Lens for major assets, suppliers and strategic initiatives.
| Dimension | Questions for leaders |
|---|---|
| Hazard | What physical change or event is relevant, and over what time horizon? |
| Exposure | Which critical assets, people, suppliers, customers and interfaces are exposed? |
| Sensitivity | What fails first, and what thresholds or dependencies amplify the consequence? |
| Adaptive capacity | What can be changed before, during and after disruption? |
| Concentration | Where do multiple dependencies share the same vulnerability? |
| Consequence | What is the effect on safety, service, revenue, cost, reputation and strategic objectives? |
The analysis should be performed at more than one level.
Asset level: What happens to the physical facility or system?
Operational level: What happens to production, service delivery, people and supply?
Enterprise level: What happens to cash flow, customers, strategic commitments and reputation?
Portfolio level: Are several investments exposed to the same hazard, geography, utility or supplier network?
This final level is frequently missed. A portfolio can look diversified by project type while remaining highly concentrated by climate exposure.
From Strategy to Execution
Immediate action: identify the organisation's most important assets and value chains, then map their critical dependencies. Do not begin with every possible climate hazard. Begin with what must keep working.
For each critical system, ask what physical conditions could interrupt it and which thresholds matter. Record assumptions that are currently untested.
Medium-term capability: integrate climate vulnerability into enterprise risk, asset management, procurement, business continuity and capital planning. Develop adaptation options before emergencies force decisions. Test supplier and infrastructure dependencies rather than relying only on site-level assessments.
Long-term positioning: use capital renewal and portfolio decisions to reduce structural vulnerability. Replacement cycles create opportunities to relocate, redesign, diversify, increase redundancy or remove fragile dependencies. Resilience is cheaper to embed when an asset is already being changed than when it must be retrofitted under pressure.
Related article: Mitigation and Adaptation Are Complementary Investment Decisions
Related article: Build Environmental Risk Into the Project Life Cycle
Signals to Monitor
Indicators that vulnerability is increasing include:
- more frequent operation close to design or environmental thresholds;
- repeated disruption at the same interface or dependency;
- rising insurance, maintenance or recovery costs;
- supplier concentration in exposed regions;
- infrastructure outages that create cascading operational effects;
- emergency responses restoring service without reducing the underlying weakness;
- capital plans that continue to replicate assets with the same vulnerabilities;
- growing dependence on communities or utilities with limited recovery capacity.
Leaders should also watch for changes in the assumptions behind existing assets. A design that was robust under historical conditions may become less robust if the operating environment changes.
Questions for the Leadership Team
- Which parts of our enterprise are most sensitive, not merely most exposed?
- What operating thresholds would cause a disproportionate loss of performance?
- Which critical dependencies sit outside our direct control?
- Where does our portfolio concentrate exposure to the same geography, utility or supplier system?
- Are we repeatedly recovering from disruption without changing the underlying vulnerability?
- What adaptation options become much more expensive if we wait?
- Which assumptions about future operating conditions are embedded in our current capital plan?
Closing Perspective
Climate vulnerability is not a label attached to a location. It is a property of a system.
Hazards matter, but the enterprise consequence is shaped by exposure, sensitivity, dependencies and adaptive capacity. That is why two organisations facing the same physical event can experience very different outcomes.
The strategic advantage comes from understanding where vulnerability is being manufactured by the organisation's own design choices—and changing those choices while options remain available.